{"id":"CVE-2026-91295","kind":"vulnerability","aliases":["CVE-2026-91295"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take over","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Enterprise Infrastructure SEC component. An attacker with a low-privilege account and network access over HTTP can take over the product, with full confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":0.00447,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Tools","fixed":["9.2.26.6 (unconfirmed, per Armis)"],"affected":">= 9.2.0.0, <= 9.2.26.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise-erp","enterpriseone","infrastructure","jd-edwards","oracle","self-hosted","vendor"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":"Check your installed EnterpriseOne Tools release (Tools release level shown in the Server Manager / Web Development Client). Exposed if it is 9.2.0.0 through 9.2.26.5 and the HTTP server is reachable by any authenticated low-privilege user.","fix":"Apply the Oracle October 2026 CPU patch for JD Edwards EnterpriseOne Tools from My Oracle Support (JD Edwards patch availability document). Armis reports 9.2.26.6 or later as the fixed level; Oracle's advisory does not state it, so confirm in the MOS note. Until patched, restrict HTTP access to the JDE application server to trusted segments and audit low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:31+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:10+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:34:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take over","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Enterprise Infrastructure SEC component. An attacker with a low-privilege account and network access over HTTP can take over the product, with full confidentiality, integrity and availability impact.","category":"vendor","who_cares":["jd-edwards","enterpriseone","oracle"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the EnterpriseOne Tools server, reading and changing all its data","analyst_note":"Find the fixed patch level and the Oracle Security Alert or CPU advisory for CVE-2026-91295; the NVD entry does not list a fix version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000506,"input_tokens":3115,"output_tokens":389,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed patch level and the Oracle Security Alert or CPU advisory for CVE-2026-91295; the NVD entry does not list a fix version.","search":"'-2026':14A,17A '-91295':15A,18A '/av':149C '3.1':136C,148C '8.8':139C '9.2.0.0':42B,101C '9.2.26.5':44B,102C 'access':64B,112C 'account':61B 'affect':99C 'allow':106C 'attack':55B,109C,122C 'avail':77B,143C 'base':137C 'compon':53B,91C 'compromis':116C 'confidenti':74B,140C 'cve':13A,16A 'cvss':135C,145C,147C 'easili':103C 'edward':3A,30B,38B,83C,90C,118C,132C 'edwards':20A 'enterpris':24B,50B,92C 'enterprise-erp':23B 'enterpriseon':4A,26B,39B,84C,119C,133C 'enterpriseone':21A 'erp':25B 'exploit':104C 'flaw':47B 'full':73B 'h':157C 'h/a':156C 'h/i':155C 'host':34B 'http':66B,114C 'impact':78B,144C 'infrastructur':27B,51B,93C 'integr':75B,141C 'jd':2A,19A,29B,37B,82C,89C,117C,131C 'jd-edward':28B 'l/pr':151C 'l/ui':152C 'low':7A,59B,107C 'low-privileg':6A,58B 'n/ac':150C 'n/s':153C 'network':9A,63B,111C 'oracl':1A,31B,36B,88C 'privileg':8A,60B,108C 'product':71B,86C 'result':127C 'score':138C 'sec':52B,94C 'self':33B 'self-host':32B 'success':121C 'support':95C 'take':12A,68B 'takeov':129C 'tool':5A,40B,85C,120C,134C 'tools':22A 'u/c':154C 'user':10A 'vector':146C 'vendor':35B 'version':41B,96C 'via':113C 'vulner':79C,105C,125C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91295","severity":null,"published_at":"2026-10-20T22:20:31+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91295:553","url":null,"severity":null,"published_at":"2026-10-23T23:57:19+00:00","modified_at":"2026-10-23T23:57:19+00:00","first_seen_at":"2026-10-23T23:57:19+00:00","fetched_at":"2026-10-23T23:57:19+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) lists JDE EnterpriseOne Tools 9.2.0.0-9.2.26.5 but gives no fixed version; Armis says 9.2.26.6+ (secondary, inferred from range end). Patch via My Oracle Support. No exploitation or PoC seen; social search not run."},{"source":"epss","external_id":"CVE-2026-91295","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91295","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2268,"url":"https://cve.armis.com/CVE-2026-91295","title":"CVE-2026-91295 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2269,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91295","title":"CVE Record: CVE-2026-91295","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}